Kaspersky Enterprise Cybersecurity

Kaspersky Incident
Response Services
www.kaspersky.com#truecybersecurityKaspersky Incident Response Services
While your IT and security specialists work hard to ensure that every network component is bothsecure against intruders and fully available to legitimate users, a single vulnerability can offer anopen door to any cybercriminal intent on gaining control over your information systems. No one
is immune: however effective your security controls, you can become a victim.
It’s becoming increasingly difficult to prevent information security incidents. But while it
may not always be possible to halt an attack before it penetrates your security perimeter, it’sabsolutely in our power to limit the resultant damage and to prevent the attack from spreading.
Kaspersky
Cybersecurity Services

Kaspersky
Threat Intelligence Services

The overall aim of Incident Response is to reduce the impact of a security breachor an attack on your IT environment. The service covers the entire incident
investigation cycle, from the onsite acquisition of evidence to the identificationof additional indications of compromise, preparing a remediation plan andcompletely eliminating the threat to your organization.
We do this by:Kaspersky
Threat Hunting Services

Kaspersky
Security Trainings••••••••

Kaspersky
Incident Response Services
Incident ResponseMalware Analysis
Digital Forensics

Kaspersky
Security Assessment Services•••

Identifying compromised resources.
Isolating the threat.
Preventing the attack from spreading.
Finding and gathering evidence.
Analyzing the evidence and reconstructing the incident’s chronology
and logic.
Analyzing the malware used in the attack (if any malware is found).
Uncovering the sources of the attack and other potentially compromised
systems (if possible).
Conducting tool-aided scans of your IT infrastructure to reveal possible signsof compromise.
Analyzing outgoing connections between your network and external
resources to detect anything suspicious (such as possible command andcontrol servers).
Eliminating the threat.
Recommending further remedial actions you can take.

Depending on whether or not you have your own incident response team,
you can ask our experts to execute the complete investigation cycle, to simply
identify and isolate compromised machines and prevent dissemination of thethreat, or to conduct Malware Analysis or Digital Forensics.
Kaspersky Lab’s Incident Response Services are carried out by highly experienced
cyber-intrusion detection analysts and investigators. The full weight of our global
expertise in Digital Forensics and Malware Analysis can be brought to bear on theresolution of your security incident.

Malware Analysis
Malware Analysis offers a complete understanding of the behavior and objectivesof the specific malware files that are targeting your organization. Kaspersky
Lab’s experts carry out a thorough analysis of the malware sample you provide,creating a detailed report that includes:• Sample properties: A short description of the sample and a verdict on its
malware classification.

1

• Detailed malware description: An in-depth analysis of your malware sample’sfunctions, threat behavior and objectives – including IOCs – arming you with
the information required to neutralize its activities.
• Remediation scenario: The report will suggest steps to fully secure yourorganization against this type of threat.

Digital Forensics
Digital Forensics can include malware analysis as above, if any malware wasdiscovered during the investigation. Kaspersky Lab experts piece together theevidence to understand exactly what’s going on, including the use of HDD
images, memory dumps and network traces. The result is a detailed elucidationof the incident. You as the customer initiate the process by gathering evidence
and providing an outline of the incident. Kaspersky Lab experts analyze theincident symptoms, identify the malware binary (if any) and conduct the malware
analysis in order to provide a detailed report including remediation steps.

Delivery options
Kaspersky Lab’s Incident Response Services are available:• By subscription• In response to a single incident
Both options are based on the amount of time our experts spend resolving
the incident – this is negotiated with you prior signing the contract. You canspecify the number of working hours you wish us to spend, or follow ourexperts’ recommendations based on the specific incident and your individualrequirements.

2Kaspersky Lab
Enterprise Cybersecurity: www.kaspersky.com/enterprise
Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com/Expert
analysis#truecybersecurity#HuMachineHuMachine™

www.kaspersky.com© 2017 AO Kaspersky Lab. All rights reserved. Registered trademarks and service
marks are the property of their respective owners.

MachineLearning

Big Data /Threat Intelligence